CVE-2013-3613
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote...
CVE-2013-3613 is a high vulnerability (CVSS 7.8) in Dahuasecurity Dvr0404hd-a, published September 17, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.66%, the 93rd percentile. No source names a fixed version.
- Severity
- 7.8 HighCVSS 2.0, NVD
- Exploit chance
- 6.66%EPSS, 93rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
Exploit likelihood
Affected products
- dahuasecurity dvr0404hd-a
- dahuasecurity dvr0404hd-l
- dahuasecurity dvr0404hd-s
- dahuasecurity dvr0404hd-u
- dahuasecurity dvr0404hf-a-e
- dahuasecurity dvr0404hf-al-e
- dahuasecurity dvr0404hf-s-e
- dahuasecurity dvr0404hf-u-e
- dahuasecurity dvr0804
- dahuasecurity dvr0804hd-l
- dahuasecurity dvr0804hd-s
- dahuasecurity dvr0804hf-a-e
Show 53 moreShow less
- dahuasecurity dvr0804hf-al-e
- dahuasecurity dvr0804hf-l-e
- dahuasecurity dvr0804hf-s-e
- dahuasecurity dvr0804hf-u-e
- dahuasecurity dvr1604hd-l
- dahuasecurity dvr1604hd-s
- dahuasecurity dvr1604hf-a-e
- dahuasecurity dvr1604hf-al-e
- dahuasecurity dvr1604hf-l-e
- dahuasecurity dvr1604hf-s-e
- dahuasecurity dvr1604hf-u-e
- dahuasecurity dvr2104c
- dahuasecurity dvr2104h
- dahuasecurity dvr2104hc
- dahuasecurity dvr2104he
- dahuasecurity dvr2108c
- dahuasecurity dvr2108h
- dahuasecurity dvr2108hc
- dahuasecurity dvr2108he
- dahuasecurity dvr2116c
- dahuasecurity dvr2116h
- dahuasecurity dvr2116hc
- dahuasecurity dvr2116he
- dahuasecurity dvr2404hf-s
- dahuasecurity dvr2404lf-al
- dahuasecurity dvr2404lf-s
- dahuasecurity dvr3204hf-s
- dahuasecurity dvr3204lf-al
- dahuasecurity dvr3204lf-s
- dahuasecurity dvr3224l
- dahuasecurity dvr3232l
- dahuasecurity dvr5104c
- dahuasecurity dvr5104h
- dahuasecurity dvr5104he
- dahuasecurity dvr5108c
- dahuasecurity dvr5108h
- dahuasecurity dvr5108he
- dahuasecurity dvr5116c
- dahuasecurity dvr5116h
- dahuasecurity dvr5116he
- dahuasecurity dvr5204a
- dahuasecurity dvr5204l
- dahuasecurity dvr5208a
- dahuasecurity dvr5208l
- dahuasecurity dvr5216a
- dahuasecurity dvr5216l
- dahuasecurity dvr5404
- dahuasecurity dvr5408
- dahuasecurity dvr5416
- dahuasecurity dvr5804
- dahuasecurity dvr5808
- dahuasecurity dvr5816
- dahuasecurity dvr6404lf-s
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit) | 2013-11-18 |
What each source reports
NVD Score used
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
- Record
CVE-2013-3613- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
- Record
CVE-2013-3613- Updated
- 2026-11-02
EUVDEUVD-2013-3547No score
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
- Record
EUVD-2013-3547- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j3x8-8c44-4q7hNo score
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote...
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
- Record
GHSA-j3x8-8c44-4q7h- Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.